@axiomatic-labs/claudeflow 2.32.21 → 2.33.0

package/lib/panel.js

@@ -230,32 +230,16 @@ function getSetupContextInfo(cwd) {
   try { ctx = JSON.parse(fs.readFileSync(p, 'utf8')); }
   catch { return { exists: false, path: p }; }
 
-  // Canonical evidence types per test-tooling-schema.md: the 5 binary `_test`
-  // types + the 2 observational `_verification` types. (benchmark /
-  // exploratory_test are conditional — triggered only by PERFORMANCE_CHANGE or
-  // unmeasurable correctness — so they are NOT required for "complete".)
-  // Source of truth: .claude/skills/claudeflow-init/references/test-tooling-schema.md.
-  const canonicalToolingTypes = [
-    'unit_test',
-    'integration_test',
-    'api_contract_test',
-    'e2e_test',
-    'security_test',
-    'browser_verification',
-    'visual_verification',
-  ];
+  const canonicalToolingTypes = ['unit_test', 'integration_test', 'api_contract_test', 'e2e_test', 'security_test'];
   const tooling = ctx.test_tooling || {};
-  // An entry is "defined" when it is shell-backed (`command_pattern`) OR
-  // Skill-backed (`invocation`). browser_verification is Skill-backed and
-  // legitimately carries NO command_pattern, so a command_pattern-only check
-  // would false-flag it as missing.
-  const isToolingDefined = (e) =>
-    e &&
-    typeof e === 'object' &&
-    ((typeof e.command_pattern === 'string' && e.command_pattern.trim()) ||
-      (typeof e.invocation === 'string' && e.invocation.trim()));
-  const toolingComplete = canonicalToolingTypes.every((t) => isToolingDefined(tooling[t]));
-  const missingTooling = canonicalToolingTypes.filter((t) => !isToolingDefined(tooling[t]));
+  const toolingComplete = canonicalToolingTypes.every((t) => {
+    const e = tooling[t];
+    return e && typeof e === 'object' && typeof e.command_pattern === 'string' && e.command_pattern.trim();
+  });
+  const missingTooling = canonicalToolingTypes.filter((t) => {
+    const e = tooling[t];
+    return !(e && typeof e === 'object' && e.command_pattern && e.command_pattern.trim());
+  });
 
   return {
     exists: true,
@@ -850,7 +834,7 @@ details[open] summary { padding-bottom: 8px; border-bottom: 1px solid var(--bord
   <span class="version" id="version">…</span>
   <span class="cwd" id="cwd">…</span>
   <span class="actions">
-    <span class="enforce-pill" id="enforce-pill" title="Master switch — toggles every blocking enforcement hook (freeze-step-contract, freeze-workflow-state, enforce-task-creation, stack-debt-guard, ecosystem-artifacts, require-build-for-code-change, workflow-enforcement). Validators and reminders are unaffected.">
+    <span class="enforce-pill" id="enforce-pill" title="Master switch — toggles every blocking enforcement hook (freeze-step-contract, enforce-task-creation, stack-debt-guard, ecosystem-artifacts, workflow-enforcement). Validators and reminders are unaffected.">
       <span class="enforce-label">Enforcement</span>
       <label class="enforce-switch"><input type="checkbox" id="enforce-toggle" /><span class="enforce-slider"></span></label>
       <span class="enforce-state" id="enforce-state">…</span>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiomatic-labs/claudeflow",
-  "version": "2.32.21",
+  "version": "2.33.0",
   "description": "Claudeflow — AI-powered development toolkit for Claude Code. Skills, agents, hooks, and quality gates that ship production apps.",
   "bin": {
     "claudeflow": "./bin/cli.js"

package/lib/hook-overrides.js

@@ -1,262 +0,0 @@
-// User hook overrides — toggle individual claudeflow hook handlers without
-// editing the template-managed `.claude/settings.json` directly.
-//
-// File: `.claudeflow/config/user-hook-overrides.json`
-// Shape:
-//   { "version": 1,
-//     "disabledHandlers": [
-//       { "event": "SessionStart", "matcher": "", "handler": "SessionStart/foo.js",
-//         "spec": { "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/SessionStart/foo.js\"" } } ] }
-//
-// The `spec` field captures the original hook entry verbatim so the panel
-// can re-enable a handler later without consulting an external snapshot.
-//
-// Two operations:
-//   - `applyHookOverrides(settings, overrides)`: pure function, returns a
-//     new settings object with disabled handlers removed. Called by
-//     install.js right after writing `.claude/settings.json` so the
-//     effective config respects the overrides on every install/update.
-//   - `toggleHookOverride(...)`: stateful, used by the panel server.
-//     Reads / writes the overrides file and the resolved settings file.
-
-const fs = require('fs');
-const path = require('path');
-
-const OVERRIDES_REL = path.join('.claudeflow', 'config', 'user-hook-overrides.json');
-const SETTINGS_REL = path.join('.claude', 'settings.json');
-// Capture every `.claude/hooks/<path>.js` token in a command string. Wrapped
-// commands include both `run-with-override.js` (the wrapper) and the actual
-// hook path; we want the LAST match — that's the real handler.
-const HOOK_PATH_REGEX_GLOBAL = /\.claude\/hooks\/([^"'\s]+\.js)/g;
-
-function readJsonSafe(absPath) {
-  try { return JSON.parse(fs.readFileSync(absPath, 'utf8')); } catch { return null; }
-}
-
-function writeJson(absPath, data) {
-  fs.mkdirSync(path.dirname(absPath), { recursive: true });
-  fs.writeFileSync(absPath, JSON.stringify(data, null, 2) + '\n');
-}
-
-function normalizeHandlerPath(command) {
-  if (!command) return '';
-  const matches = [...command.matchAll(HOOK_PATH_REGEX_GLOBAL)];
-  if (matches.length === 0) {
-    return command.replace(/^node\s+/, '').replace(/^["']|["']$/g, '').trim();
-  }
-  // Skip the wrapper itself when present; pick the last non-wrapper match.
-  const real = matches.filter((m) => m[1] !== 'run-with-override.js');
-  const chosen = real.length ? real[real.length - 1] : matches[matches.length - 1];
-  return chosen[1];
-}
-
-function defaultOverrides() {
-  return {
-    version: 1,
-    disabledHandlers: [],
-    disabledReminders: [],
-    enforcementDisabled: false,
-    runToCompletionReminderEnabled: false,
-    cwdLockEnabled: false,
-  };
-}
-
-function readOverrides(projectRoot) {
-  const data = readJsonSafe(path.join(projectRoot, OVERRIDES_REL));
-  if (!data || typeof data !== 'object') return defaultOverrides();
-  return {
-    version: data.version || 1,
-    disabledHandlers: Array.isArray(data.disabledHandlers) ? data.disabledHandlers : [],
-    disabledReminders: Array.isArray(data.disabledReminders) ? data.disabledReminders : [],
-    enforcementDisabled: data.enforcementDisabled === true,
-    runToCompletionReminderEnabled: data.runToCompletionReminderEnabled === true,
-    cwdLockEnabled: data.cwdLockEnabled === true,
-  };
-}
-
-function writeOverrides(projectRoot, overrides) {
-  writeJson(path.join(projectRoot, OVERRIDES_REL), overrides);
-}
-
-function matchesOverride(override, event, matcher, handlerCommand) {
-  if (override.event !== event) return false;
-  if ((override.matcher || '') !== (matcher || '')) return false;
-  return normalizeHandlerPath(handlerCommand) === override.handler;
-}
-
-// Returns a fresh settings object with handlers disabled by `overrides` removed.
-// Empty rules are pruned. The shape of `settings.hooks` is preserved otherwise.
-function applyHookOverrides(settings, overrides) {
-  const disabled = (overrides && overrides.disabledHandlers) || [];
-  if (!disabled.length || !settings || !settings.hooks) return settings;
-  const next = JSON.parse(JSON.stringify(settings));
-  const hooks = next.hooks;
-  for (const event of Object.keys(hooks)) {
-    const rules = Array.isArray(hooks[event]) ? hooks[event] : [];
-    for (let i = rules.length - 1; i >= 0; i--) {
-      const rule = rules[i] || {};
-      const matcher = rule.matcher || '';
-      const remaining = (rule.hooks || []).filter(
-        (h) => !disabled.some((d) => matchesOverride(d, event, matcher, h.command || '')),
-      );
-      if (remaining.length === 0) rules.splice(i, 1);
-      else rule.hooks = remaining;
-    }
-    hooks[event] = rules;
-  }
-  return next;
-}
-
-// Apply on disk: read settings.json + overrides, write the pruned settings
-// back. Idempotent — calling twice produces the same file.
-function applyOverridesToFile(projectRoot) {
-  const settingsPath = path.join(projectRoot, SETTINGS_REL);
-  const settings = readJsonSafe(settingsPath);
-  if (!settings) return false;
-  const overrides = readOverrides(projectRoot);
-  if (!overrides.disabledHandlers.length) return false;
-  const next = applyHookOverrides(settings, overrides);
-  fs.writeFileSync(settingsPath, JSON.stringify(next, null, 2) + '\n');
-  return true;
-}
-
-// Find a hook entry in current settings.json by event/matcher/handler.
-// Used when disabling: we capture the spec before removing it.
-function findHandlerInSettings(settings, event, matcher, handler) {
-  const rules = (settings.hooks && settings.hooks[event]) || [];
-  for (const rule of rules) {
-    if ((rule.matcher || '') !== (matcher || '')) continue;
-    for (const h of rule.hooks || []) {
-      if (normalizeHandlerPath(h.command || '') === handler) return h;
-    }
-  }
-  return null;
-}
-
-// Add an entry back to the live settings under the right event/matcher.
-function restoreHandlerInSettings(settings, event, matcher, spec) {
-  if (!settings.hooks) settings.hooks = {};
-  if (!settings.hooks[event]) settings.hooks[event] = [];
-  const rules = settings.hooks[event];
-  let rule = rules.find((r) => (r.matcher || '') === (matcher || ''));
-  if (!rule) {
-    rule = { matcher, hooks: [] };
-    rules.push(rule);
-  }
-  // Avoid duplicate restoration if the spec is already present
-  const already = rule.hooks.some((h) => normalizeHandlerPath(h.command || '') === normalizeHandlerPath(spec.command || ''));
-  if (!already) rule.hooks.push(spec);
-}
-
-// Stateful toggle used by the panel. Only edits overrides.json — settings.json
-// is never mutated. The wrapper (.claude/hooks/run-with-override.js) reads
-// overrides on every invocation, so disable/enable takes effect on the next
-// hook fire (no Claude Code restart required).
-//
-// Settings.json is also consulted to verify the handler exists at all
-// (refuses to disable a phantom handler), but it is never written.
-function toggleHookOverride(projectRoot, { event, matcher = '', handler, disable }) {
-  const settingsPath = path.join(projectRoot, SETTINGS_REL);
-  const settings = readJsonSafe(settingsPath) || { hooks: {} };
-  const overrides = readOverrides(projectRoot);
-  const matcherKey = matcher || '';
-
-  if (disable) {
-    const already = overrides.disabledHandlers.find(
-      (d) => d.event === event && (d.matcher || '') === matcherKey && d.handler === handler,
-    );
-    if (already) return { state: 'noop', reason: 'already-disabled' };
-    if (!findHandlerInSettings(settings, event, matcherKey, handler)) {
-      return { state: 'error', reason: 'handler-not-found-in-settings' };
-    }
-    overrides.disabledHandlers.push({ event, matcher: matcherKey, handler });
-    writeOverrides(projectRoot, overrides);
-    return { state: 'disabled' };
-  }
-
-  const idx = overrides.disabledHandlers.findIndex(
-    (d) => d.event === event && (d.matcher || '') === matcherKey && d.handler === handler,
-  );
-  if (idx === -1) return { state: 'noop', reason: 'not-disabled' };
-  overrides.disabledHandlers.splice(idx, 1);
-  writeOverrides(projectRoot, overrides);
-  return { state: 'enabled' };
-}
-
-// Master enforcement switch. When OFF, the wrapper silences every hook
-// listed in `.claude/hooks/shared/enforcement-catalog.js` regardless of
-// per-handler manual toggles. Per-handler toggles outside the catalog
-// remain in effect — they are independent layers.
-function toggleEnforcementMode(projectRoot, { disable }) {
-  if (typeof disable !== 'boolean') return { state: 'error', reason: 'disable-required' };
-  const overrides = readOverrides(projectRoot);
-  if (overrides.enforcementDisabled === disable) {
-    return { state: 'noop', reason: disable ? 'already-off' : 'already-on' };
-  }
-  overrides.enforcementDisabled = disable;
-  writeOverrides(projectRoot, overrides);
-  return { state: disable ? 'off' : 'on' };
-}
-
-// Toggle the run-to-completion reminder. Independent of the master
-// enforcement switch — it's a soft nudge, not a gate. Default OFF.
-function toggleRunToCompletionReminder(projectRoot, { enable }) {
-  if (typeof enable !== 'boolean') return { state: 'error', reason: 'enable-required' };
-  const overrides = readOverrides(projectRoot);
-  if (overrides.runToCompletionReminderEnabled === enable) {
-    return { state: 'noop', reason: enable ? 'already-on' : 'already-off' };
-  }
-  overrides.runToCompletionReminderEnabled = enable;
-  writeOverrides(projectRoot, overrides);
-  return { state: enable ? 'on' : 'off' };
-}
-
-// Toggle the cwd-lock hook. Independent of the master enforcement switch —
-// the CwdChanged hook is not in the enforcement-catalog and ignores the
-// master switch by design (you can lock cwd even with enforcement off).
-function toggleCwdLock(projectRoot, { enable }) {
-  if (typeof enable !== 'boolean') return { state: 'error', reason: 'enable-required' };
-  const overrides = readOverrides(projectRoot);
-  if (overrides.cwdLockEnabled === enable) {
-    return { state: 'noop', reason: enable ? 'already-on' : 'already-off' };
-  }
-  overrides.cwdLockEnabled = enable;
-  writeOverrides(projectRoot, overrides);
-  return { state: enable ? 'on' : 'off' };
-}
-
-// Toggle a single reminder by id. Same persistence file, same hot-reload
-// semantics — `reload-reminder.js` re-reads overrides on every invocation.
-function toggleReminderOverride(projectRoot, { id, disable }) {
-  if (typeof id !== 'string' || !id.trim()) return { state: 'error', reason: 'id-required' };
-  const overrides = readOverrides(projectRoot);
-  const list = overrides.disabledReminders;
-  const idx = list.indexOf(id);
-
-  if (disable) {
-    if (idx !== -1) return { state: 'noop', reason: 'already-disabled' };
-    list.push(id);
-    writeOverrides(projectRoot, overrides);
-    return { state: 'disabled' };
-  }
-  if (idx === -1) return { state: 'noop', reason: 'not-disabled' };
-  list.splice(idx, 1);
-  writeOverrides(projectRoot, overrides);
-  return { state: 'enabled' };
-}
-
-module.exports = {
-  OVERRIDES_REL,
-  SETTINGS_REL,
-  applyHookOverrides,
-  applyOverridesToFile,
-  readOverrides,
-  writeOverrides,
-  toggleHookOverride,
-  toggleReminderOverride,
-  toggleEnforcementMode,
-  toggleRunToCompletionReminder,
-  toggleCwdLock,
-  normalizeHandlerPath,
-  matchesOverride,
-};

package/lib/preview.js

@@ -1,360 +0,0 @@
-// `claudeflow preview` — standing, decoupled live-preview server for prototypes.
-//
-// Serves .claudeflow/prototypes/ over http://127.0.0.1:<port>, watches the
-// files, and pushes live updates over SSE — CSS edits hot-swap (no flicker),
-// HTML edits reload only the changed document / the content iframe (the shell
-// stays). The user runs this ONCE and leaves it; the /claudeflow-prototype flow
-// just writes files into the watched dir and never touches this process. That
-// decoupling is the whole point: the fragility the project hit came from servers
-// the BUILD/observer flow spawned + killed — this one is user-owned (start it,
-// Ctrl-C to stop), so the flow adds no steps and manages no process.
-//
-// Zero runtime dependencies — Node built-ins only. Opened directly as file://,
-// a prototype is still a static snapshot; live-reload is purely this server's job
-// (the live client is INJECTED into served HTML, so prototype files stay pure).
-
-const http = require("http");
-const fs = require("fs");
-const path = require("path");
-const { spawn } = require("child_process");
-
-const ui = require("./ui.js");
-
-const MIME = {
-  ".html": "text/html; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".js": "text/javascript; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".ico": "image/x-icon",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".ttf": "font/ttf",
-  ".map": "application/json; charset=utf-8",
-};
-
-const SSE_PATH = "/__livereload";
-
-// Injected into every served .html. Connects to the SSE stream; CSS changes
-// hot-swap the <link>s (flicker-free), other changes reload the changed
-// document — or, if this doc is the shell (has an <iframe>), just its iframe
-// so navigation + the shell survive.
-const LIVE_CLIENT = `
-<script data-claudeflow-livereload>
-(function () {
-  try {
-    var es = new EventSource(${JSON.stringify(SSE_PATH)});
-    es.onmessage = function (e) {
-      var p = (e.data || '').trim();
-      if (!p) return;
-      if (/\\.css($|\\?)/.test(p)) {
-        document.querySelectorAll('link[rel="stylesheet"]').forEach(function (l) {
-          var u = l.href.split('?')[0];
-          l.href = u + '?t=' + Date.now();
-        });
-        return;
-      }
-      var here = decodeURIComponent(location.pathname.replace(/^\\//, ''));
-      if (p && here && (p === here || here.endsWith(p) || p.endsWith(here))) {
-        location.reload();
-        return;
-      }
-      var f = document.querySelector('iframe');
-      if (f) { try { f.contentWindow.location.reload(); return; } catch (_) {} }
-      location.reload();
-    };
-  } catch (_) {}
-})();
-</script>`;
-
-function listPrototypes(root) {
-  let entries = [];
-  try {
-    entries = fs.readdirSync(root, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-  return entries
-    .filter((e) => e.isDirectory())
-    .map((e) => e.name)
-    .filter((name) => fs.existsSync(path.join(root, name, "index.html")))
-    .sort();
-}
-
-function listingPage(root) {
-  const protos = listPrototypes(root);
-  const items = protos.length
-    ? protos
-        .map((p) => `<li><a href="/${p}/index.html">${p}</a></li>`)
-        .join("\n")
-    : '<li class="muted">No prototypes yet — assemble one with /claudeflow-prototype (writes into .claudeflow/prototypes/).</li>';
-  return `<!doctype html><html><head><meta charset="utf-8"><title>claudeflow preview</title>
-<style>body{font:15px/1.5 -apple-system,system-ui,sans-serif;max-width:640px;margin:48px auto;padding:0 20px;color:#1c1c22}
-h1{font-size:18px}a{color:#5050d4}.muted{color:#717180}li{margin:6px 0}</style></head>
-<body><h1>claudeflow preview</h1><p class="muted">Serving <code>.claudeflow/prototypes/</code> with live reload.</p>
-<ul>${items}</ul></body></html>`;
-}
-
-// Resolve the requested URL to a file under root, blocking path traversal.
-function resolveFile(root, urlPath) {
-  const clean = decodeURIComponent(urlPath.split("?")[0]).replace(/\/+$/, "");
-  const abs = path.normalize(path.join(root, clean));
-  if (abs !== root && !abs.startsWith(root + path.sep)) return null; // traversal guard
-  return abs;
-}
-
-function injectLiveClient(html) {
-  const marker = /<\/body>/i;
-  return marker.test(html)
-    ? html.replace(marker, LIVE_CLIENT + "\n</body>")
-    : html + LIVE_CLIENT;
-}
-
-// Debounced recursive watcher with a polling fallback (recursive fs.watch is not
-// supported on every platform/Node). Calls onChange(relPath) on edits.
-function watch(root, onChange) {
-  let timer = null;
-  let lastPath = "";
-  const fire = (rel) => {
-    lastPath = rel || lastPath;
-    clearTimeout(timer);
-    timer = setTimeout(() => onChange(lastPath), 120);
-  };
-  try {
-    const w = fs.watch(root, { recursive: true }, (_evt, filename) => {
-      if (filename) fire(String(filename).split(path.sep).join("/"));
-    });
-    w.on("error", () => {});
-    return () => w.close();
-  } catch {
-    // Polling fallback: scan mtimes every second.
-    const seen = new Map();
-    const scan = (dir, base) => {
-      let ents = [];
-      try {
-        ents = fs.readdirSync(dir, { withFileTypes: true });
-      } catch {
-        return;
-      }
-      for (const e of ents) {
-        const abs = path.join(dir, e.name);
-        const rel = base ? base + "/" + e.name : e.name;
-        if (e.isDirectory()) {
-          scan(abs, rel);
-        } else {
-          let m = 0;
-          try {
-            m = fs.statSync(abs).mtimeMs;
-          } catch {
-            continue;
-          }
-          if (seen.has(rel) && seen.get(rel) !== m) fire(rel);
-          seen.set(rel, m);
-        }
-      }
-    };
-    scan(root, "");
-    const iv = setInterval(() => scan(root, ""), 1000);
-    return () => clearInterval(iv);
-  }
-}
-
-function openBrowser(url) {
-  const cmd =
-    process.platform === "darwin"
-      ? { c: "open", a: [url] }
-      : process.platform === "win32"
-        ? { c: "cmd", a: ["/c", "start", "", url] }
-        : { c: "xdg-open", a: [url] };
-  try {
-    const child = spawn(cmd.c, cmd.a, { stdio: "ignore", detached: true });
-    child.on("error", () => {});
-    child.unref();
-  } catch {
-    /* best-effort */
-  }
-}
-
-function parseArgs(argv) {
-  const out = { proto: null, port: null, open: true };
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === "--port" || a === "-p") out.port = Number(argv[++i]);
-    else if (a === "--no-open") out.open = false;
-    else if (!a.startsWith("-")) out.proto = a;
-  }
-  return out;
-}
-
-async function preview(argv = []) {
-  const { proto, port: wantPort, open } = parseArgs(argv);
-  const cwd = process.cwd();
-  const protosRoot = path.join(cwd, ".claudeflow", "prototypes");
-
-  // Root to serve: a specific prototype subdir, or the prototypes parent (listing).
-  let root = protosRoot;
-  if (proto) {
-    const sub = path.join(protosRoot, proto);
-    if (!fs.existsSync(sub)) {
-      console.error(
-        `${ui.RED}No prototype "${proto}" under ${protosRoot}${ui.RESET}`,
-      );
-      return 1;
-    }
-    root = sub;
-  }
-  try {
-    fs.mkdirSync(protosRoot, { recursive: true });
-  } catch {
-    /* best-effort — listing/watch handle a missing dir */
-  }
-
-  const clients = new Set();
-  const server = http.createServer((req, res) => {
-    const urlPath = (req.url || "/").split("?")[0];
-
-    if (urlPath === SSE_PATH) {
-      res.writeHead(200, {
-        "Content-Type": "text/event-stream",
-        "Cache-Control": "no-cache",
-        Connection: "keep-alive",
-      });
-      res.write(": connected\n\n");
-      clients.add(res);
-      req.on("close", () => clients.delete(res));
-      return;
-    }
-
-    // Listing at root when serving the prototypes parent and no index there.
-    if (
-      (urlPath === "/" || urlPath === "") &&
-      !fs.existsSync(path.join(root, "index.html"))
-    ) {
-      const body = listingPage(root);
-      res.writeHead(200, {
-        "Content-Type": MIME[".html"],
-        "Cache-Control": "no-store",
-      });
-      res.end(injectLiveClient(body));
-      return;
-    }
-
-    let file = resolveFile(root, urlPath);
-    if (!file) {
-      res.writeHead(403);
-      res.end("Forbidden");
-      return;
-    }
-    try {
-      if (fs.statSync(file).isDirectory()) file = path.join(file, "index.html");
-    } catch {
-      /* fall through to 404 below */
-    }
-    let buf;
-    try {
-      buf = fs.readFileSync(file);
-    } catch {
-      res.writeHead(404, { "Content-Type": MIME[".html"] });
-      res.end(
-        injectLiveClient(
-          '<!doctype html><body style="font-family:system-ui;padding:40px">404 — not found</body>',
-        ),
-      );
-      return;
-    }
-    const ext = path.extname(file).toLowerCase();
-    const type = MIME[ext] || "application/octet-stream";
-    if (ext === ".html") {
-      res.writeHead(200, { "Content-Type": type, "Cache-Control": "no-store" });
-      res.end(injectLiveClient(buf.toString("utf8")));
-    } else {
-      res.writeHead(200, { "Content-Type": type, "Cache-Control": "no-store" });
-      res.end(buf);
-    }
-  });
-
-  const stopWatch = watch(protosRoot, (rel) => {
-    for (const c of clients) {
-      try {
-        c.write(`data: ${rel}\n\n`);
-      } catch {
-        /* drop dead client */
-      }
-    }
-  });
-
-  const onPort = (actualPort) => {
-    const url = `http://127.0.0.1:${actualPort}/`;
-    console.log("");
-    console.log(
-      `  ${ui.GREEN}claudeflow preview${ui.RESET} — live reload for prototypes`,
-    );
-    console.log(
-      `  ${ui.CYAN}${url}${ui.RESET}  ${ui.DIM}(serving .claudeflow/prototypes/)${ui.RESET}`,
-    );
-    console.log(
-      `  ${ui.DIM}CSS edits hot-swap (no flicker); HTML edits reload the changed view. Ctrl-C to stop.${ui.RESET}`,
-    );
-    console.log("");
-    if (open) openBrowser(proto ? url : url);
-  };
-
-  await new Promise((resolve) => {
-    const tryListen = (p, allowFallback) => {
-      server.once("error", (err) => {
-        if (err && err.code === "EADDRINUSE" && allowFallback) {
-          tryListen(0, false); // OS-assigned free port
-        } else {
-          console.error(
-            `${ui.RED}preview server error: ${err.message}${ui.RESET}`,
-          );
-          resolve();
-        }
-      });
-      server.listen(p, "127.0.0.1", () => {
-        onPort(server.address().port);
-        resolve();
-      });
-    };
-    // Default to an UNCOMMON port (4793) to avoid squatting a port the project's
-    // dev server wants (e.g. 4321=Astro, 5173=Vite, 3000=Next, 4200=Angular).
-    // --port is strict (no fallback — the user demanded it); the default + the
-    // CLAUDEFLOW_PREVIEW_PORT override fall back to an OS-assigned free port if taken,
-    // so preview NEVER collides with a running dev server.
-    const envPort = Number(process.env.CLAUDEFLOW_PREVIEW_PORT) || 0;
-    const preferred = wantPort || envPort || 4793;
-    tryListen(preferred, !wantPort);
-  });
-
-  const shutdown = () => {
-    try {
-      stopWatch();
-    } catch {
-      /* ignore */
-    }
-    for (const c of clients) {
-      try {
-        c.end();
-      } catch {
-        /* ignore */
-      }
-    }
-    server.close(() => process.exit(0));
-    setTimeout(() => process.exit(0), 300).unref();
-  };
-  process.on("SIGINT", shutdown);
-  process.on("SIGTERM", shutdown);
-
-  // Keep the process alive (standing server).
-  return new Promise(() => {});
-}
-
-module.exports = preview;
-module.exports.injectLiveClient = injectLiveClient;
-module.exports.resolveFile = resolveFile;
-module.exports.listPrototypes = listPrototypes;